<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Hi Again,<br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">For enforcing SSH key rotation every N days, I'm thinking the following. Please let me know if this makes sense. <br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">1. Limit the number of keys per user to 2. Control this via the webUI during they public key upload. <br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">2. Append the current timestamp to the key during the upload. This gets stores in LDAP under "ipaSshPubKey" attribute. <br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">3. Store all the key fingerprints permanently. Need to define a new attribute for this. Idea is that a ssh key never gets reused. During the upload verify that the key being uploaded is not already present in the historical store. <br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">4. On the clients, use a ForcedCommand in SSH server and verify the timestamp from #2 above is older than N days. Deny user with a error message if true, allow if false. On similar lines of <a href="http://www.sshark.org/">http://www.sshark.org/</a><br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Please let me know your thoughts around this. This is the limiting feature for us to implement FreeIPA in our org right now. <br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thanks in advance. <br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">--Prashant <br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 23 December 2014 at 21:39, Prashant Bapat <span dir="ltr"><<a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Adam,<br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thanks much for the reply. I will take a look at the code. <br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">For the expiration part, do you think it would be a good idea to modify the LDAP schema to include the SSH Pubkey upload date and have a external script to scan the keys for their age and alert/remove the keys ? If yes could you please give me some pointers on how this can be done ?<br><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thanks again. <br></div><span class="HOEnZb"><font color="#888888"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">--Prashant<br></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On 23 December 2014 at 19:45, Adam Young <span dir="ltr"><<a href="mailto:ayoung@redhat.com" target="_blank">ayoung@redhat.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><span>
<div>On 12/22/2014 08:40 PM, Prashant Bapat
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Hi,<br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">We are planning to roll out FreeIPA for our AWS
infrastructure to be the central authentication service.
Initially we plan to use the SSH publi keys, user and group
management by FreeIPA. We are looking at rolling out the SSS
on clients a little later. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Two questions. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">1. We need to be able to ensure that a user is
limited only 2-3 SSH keys. <br>
</div>
</div>
</blockquote></span>
SSH keys are a string attribute with a validator. In order to limit
the number, you would need to modify the plugin here:<br>
<br>
<br>
<a href="https://git.fedorahosted.org/cgit/freeipa.git/tree/ipalib/util.py#n310" target="_blank">https://git.fedorahosted.org/cgit/freeipa.git/tree/ipalib/util.py#n310</a><span><br>
<br>
<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">2. We need some way of forcing these key
rotation once in say 90 days. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">In our existing setup we use a SSH CA based
authentication. It has its own issues. But the rotation is
handled by cert expiry every 90 days. <br>
</div>
</div>
</blockquote>
<br></span>
This is going to be harder. With password you can validate on
login, but there is caching involved with the public key, and I
think you would need to take that into account to force
invalidation. This is why certs are probably a better idea.<br>
<br>
Assuming you can flush the public keys fairly regularly, you would
want to put the expiration checking on the accessor for the key.
This is a direct ldap fetch and not managed by the IPA plugins.<br>
<br>
<blockquote type="cite"><span>
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Any suggestions/help would be appreciated. <br>
<br>
Thanks in advance. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet ms,sans-serif">--Prashant<br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</span><pre>_______________________________________________
Freeipa-devel mailing list
<a href="mailto:Freeipa-devel@redhat.com" target="_blank">Freeipa-devel@redhat.com</a>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-devel" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre>
</blockquote>
<br>
</div>
<br>_______________________________________________<br>
Freeipa-devel mailing list<br>
<a href="mailto:Freeipa-devel@redhat.com" target="_blank">Freeipa-devel@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-devel" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-devel</a><br></blockquote></div></div>
</div></div></blockquote></div><br></div>